• build(deps): bump actions/cache from 5.0.5 to 6.1.0 by @dependabot[bot] in https://github.com/Activiti/Activiti/pull/5457
• build(deps): bump the github-actions group across 1 directory with 12 updates by @dependabot[bot] in https://github.com/Activiti/Activiti/pull/5456

• AAE-47587 Update tools.jackson:jackson-bom to 3.1.4 by @killerboot in https://github.com/Activiti/Activiti/pull/5453
• AAE-47288 Pin modern Checkstyle engine to unblock modern Java language features in BE repos by @mkrbr in https://github.com/Activiti/Activiti/pull/5458

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.407...7.21.0-rc.408

2026-07-09 Release of logback version 1.5.38

• In HardenedObjectInputStream, fixed a typo preventing Throwable objects from being white-filtered. This issue was reported in PR #1045 by t0rchwo0d.

• A bitwise identical binary of this version can be reproduced by building from source code at commit d04984a41fce42977466f45a2f076f0ee5cc4207 associated with the tag v_1.5.38. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.406...7.21.0-rc.407

• SingleThreadEventExecutor: document Throwable safety contract on run() by @daguimu in https://github.com/netty/netty/pull/16814
• Make HTTP/2 frame hashCode consistent with equals by @daguimu in https://github.com/netty/netty/pull/16692
• Add BlockHound exception for DnsQueryIdSpace (#16896) by @chrisvest in https://github.com/netty/netty/pull/16915
• FlowControlHandler: Fix autoRead behavior by @chrisvest in https://github.com/netty/netty/pull/16912
• Auto-port 4.1: Fix incorrect bounds in error message of HpackDecoder.setMaxHeaderListSize by @netty-project-bot in https://github.com/netty/netty/pull/16911
• MQTT: Fix MQTT decoder size check after variable header replay by @daguimu in https://github.com/netty/netty/pull/16916
• MQTT: Make the decodeProperties early-REPLAY check actually fire by @daguimu in https://github.com/netty/netty/pull/16813
• Reject control characters at the boundary of HTTP method names (#16723) by @chrisvest in https://github.com/netty/netty/pull/16933
• Auto-port 4.1: Update to latest tcnative release by @netty-project-bot in https://github.com/netty/netty/pull/16941
• Auto-port 4.1: Fix HTTP 2 PUSH_PROMISE stream association validation by @netty-project-bot in https://github.com/netty/netty/pull/16955
• Auto-port 4.1: Fix GZIP FEXTRA extra-field handling in JdkZlibDecoder by @netty-project-bot in https://github.com/netty/netty/pull/16957
• Auto-port 4.1: Add opt-in validation of mandatory pseudo-header fields for HTTP/2 by @netty-project-bot in https://github.com/netty/netty/pull/16964
• Strictly validate MQTT UTF-8 Encoded String (#16939) by @chrisvest in https://github.com/netty/netty/pull/16965
• Auto-port 4.1: Stop DateFormatter trailing token from running past the parse end by @netty-project-bot in https://github.com/netty/netty/pull/16968
• Auto-port 4.1: IpFilter: Deprecate constructor which use accept by default by @netty-project-bot in https://github.com/netty/netty/pull/16973
• Add RFC 10008 QUERY Method support (#16966) by @normanmaurer in https://github.com/netty/netty/pull/16978
• Correctly release and fail queued traffic-shaping writes on close (#16959) by @normanmaurer in https://github.com/netty/netty/pull/16976
• Auto-port 4.1: FlowControlHandler: respect auto-read when toggled while dequeueing by @netty-project-bot in https://github.com/netty/netty/pull/16983
• IdleStateHandler: reset firstWriter/ReaderIdleEvent in resetWriteTimeout/resetReadTimeout (#16982) by @chrisvest in https://github.com/netty/netty/pull/16989
• Auto-port 4.1: Fix typo in AbstractSniHandler Javadoc by @netty-project-bot in https://github.com/netty/netty/pull/16995
• Auto-port 4.1: Reconcile AbstractCoalescingBufferQueue readableBytes when it drains, and fail stuck HTTP/2 streams instead of spinning empty DATA frames by @netty-project-bot in https://github.com/netty/netty/pull/16997
• Reject control characters at the boundary of the HTTP version token (#16971) by @normanmaurer in https://github.com/netty/netty/pull/16986
• Auto-port 4.1: Reset UTF-8 decode state on CR in StompSubframeDecoder by @netty-project-bot in https://github.com/netty/netty/pull/17003
• Auto-port 4.1: HTTP2: Pass the correct number of arguments when logging goaway by @netty-project-bot in https://github.com/netty/netty/pull/17017
• FastLz: Guard decompression against truncated input (#17000) by @chrisvest in https://github.com/netty/netty/pull/17015
• Backport 4.1 Fix propagation of startTls for client SslContext handler by @skyguard1 in https://github.com/netty/netty/pull/17020
• Auto-port 4.1: Reject non-token characters in HTTP/2 header names by @netty-project-bot in https://github.com/netty/netty/pull/17022
• Update lz4-java to 1.11.1 by @yawkat in https://github.com/netty/netty/pull/17060
• Pin github actions to reduce risk (#17043) by @normanmaurer in https://github.com/netty/netty/pull/17044
• Merge branches from forks (#17063) by @normanmaurer in https://github.com/netty/netty/pull/17065

Full Changelog: https://github.com/netty/netty/compare/netty-4.1.135.Final...netty-4.1.136.Final

• Revert "xds: reuse connections to the control plane across channels" added in 1.81.0 (#12886). If using xds heavily with many targets, then MAX_CONCURRENT_STREAMS to the control plane could be exceeded. This then prevents loading resources for new targets, which causes those channels to hang on name resolution. RPCs would see the nondescript "DEADLINE_EXCEEDED: Deadline Context was exceeded after Xs" or "DEADLINE_EXCEEDED: Deadline CallOptions was exceeded after Xs"

• Revert "xds: reuse connections to the control plane across channels" added in 1.81.0 (#12887). If using xds heavily with many targets, then MAX_CONCURRENT_STREAMS to the control plane could be exceeded. This then prevents loading resources for new targets, which causes those channels to hang on name resolution. RPCs would see the nondescript "DEADLINE_EXCEEDED: Deadline Context was exceeded after Xs" or "DEADLINE_EXCEEDED: Deadline CallOptions was exceeded after Xs"

• 6283602: [rb] generate the BiDi protocol layer from the shared binding-neutral schema (#17731) (Titus Fortner) #17731
• 52a6dad: [docs] ADR implementation updates - track by PR number, clarify PR body vs ADR, tracking status by issue (#17697) (Titus Fortner) #17697
• 4c140e1: [build] Add update_cddl script to refresh pinned w3c/webref CDDL files (#17743) (Titus Fortner) #17743
• ee4057c: Add guidance for testing conventions in each language (#16734) (Titus Fortner) #16734
• 15ee583: [build] document .local customization and add PR review guidance (#17756) (Titus Fortner) #17756
• 185e626: [build] fix python linting in format.sh script (Titus Fortner)

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.405...7.21.0-rc.406

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.404...7.21.0-rc.405